3 ms·

exactly, and vk.com (biggest social network in europe) is a showcase. They use such framebreaker: if (parent && parent != window && (browser.msie || browser

by homakov 14y ago

exactly, and vk.com (biggest social network in europe) is a showcase. They use such framebreaker: if (parent && parent != window && (browser.msie || browser.opera || browser.mozilla || browser.chrome || browser.safari || browser.iphone)) { document.getElementsByTagName('body')[0].innerHTML = ''; } It cannot be bypassed with NoContent trick by the way. Because it removes body, not navigates the parent

tptacek 14y ago
Isn't that exactly the kind of framebuster Boneh says doesn't work?
- homakov 14y ago
  I don't think so, what bypasses this one? (besides sandbox and XSS Auditor trick)
  - tptacek 14y ago
    Read the paper I posted up thread.
    - homakov 14y ago
      double checked http://seclab.stanford.edu/websec/framebusting/framebust.pdf http://seclab.stanford.edu/websec/framebusting/framebust.pdf there are many parent-navigation bypasses in this paper but nothing for innerHTML='' (not taking into account sandbox and xss auditor)
    - homakov 14y ago
      Table 2: Frame busting conditional statement we consider following tricks: document.write('') setTimeout(function(){document.body.innerHTML='';},1); window.self.onload = function(evt){document.body.innerHTML='';} None of them was bypassed further in the paper. (I used Ctrl+F)
esailija 14y ago
What are the browser checks for?